Is CVE-2026-96533 being exploited?

No public exploit is currently tracked.

Back

CVE-2026-96533

Description

The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-supplied URL before fetching it server-side and storing the response as a public file, allowing unauthenticated users to make the server issue requests to internal services and read the responses.